一句话：首个不限于特定漏洞类的注入式漏洞生成技术，结合模式挖掘与深度学习生成高质量易受攻击样本。
构建强大的数据驱动漏洞防御方案和大规模基准测试需要大规模、高质量的漏洞数据集，但现有自动生成易受攻击样本的技术存在明显局限，且通常只适用于特定漏洞类别。VULGEN 是首个不限于特定漏洞类的注入式漏洞生成技术，它将确定性的基于模式的程序变换与概率性的深度学习变换相结合，通过模式挖掘/应用与基于深度学习的注入定位协同工作，分离“如何注入”与“在哪里注入”两个问题。借助大规模预训练编程语言模型并仅学习注入位置，VULGEN 降低了对高质量漏洞训练数据的依赖。大量评估表明，VULGEN 在生成样本中漏洞样本占比及与真实漏洞完全匹配的比例上显著优于 SOTA 模式方法以及基于 Transformer 和 GNN 的方法，分别提升 38.0–430.1% 和 16.3–158.2%；其生成样本使两个 SOTA 深度学习漏洞检测器的 F1 最高提升 31.8%，接近真实样本带来的提升，并远高于同等数量现有合成样本的效果。
Building new, powerful data-driven defenses against prevalent software vulnerabilities needs sizable, quality vulnerability datasets, so does large-scale benchmarking of existing defense solutions. Automatic data generation would promisingly meet the need, yet there is little work aimed to generate much-needed quality vulnerable samples. Meanwhile, existing similar and adaptable techniques suffer critical limitations for that purpose. In this paper, we present VULGEN, the first injection-based vulnerability-generation technique that is not limited to a particular class of vulnerabilities. VULGEN combines the strengths of deterministic (pattern-based) and probabilistic (deep-learning/DL-based) program transformation approaches while mutually overcoming respective weaknesses. This is achieved through close collaborations between pattern mining/application and DL-based injection localization, which separates the concerns with how and where to inject. By leveraging large, pretrained programming language modeling and only learning locations, VULGEN mitigates its own needs for quality vulnerability data (for training the localization model). Extensive evaluations show that VULGEN significantly outperforms a state-of-the-art (SOTA) pattern-based peer technique as well as both Transformer- and GNN-based approaches in terms of the percentages of generated samples that are vulnerable and those also exactly matching the ground truth (by 38.0-430.1% and 16.3-158.2%, respectively). The VULGEN-generated samples led to substantial performance improvements for two SOTA DL-based vulnerability detectors (by up to 31.8% higher in F1), close to those brought by the ground-truth real-world samples and much higher than those by the same numbers of existing synthetic samples.
@inproceedings{NongOPCC23,
title = {VULGEN: Realistic Vulnerability Generation Via Pattern Mining and Deep Learning},
author = {Yu Nong and Yuzhe Ou and Michael Pradel and Feng Chen and Haipeng Cai},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00211}
}